Path traversal in profile snippets import allows writing files outside the profile directory (Zip-Slip)

MediumCVE-2026-47287 · Published Jun 9, 2026

## VS Code - Security Feature Bypass Vulnerability An elevation of privilege vulnerability exists in VS Code 1.123.0 and earlier versions where a user who is tricked into importing a crafted .code-profile file containing a snippet entry with a maliciously crafted name could have attacker-controlled content written to an arbitrary file location outside the intended profile snippets directory. The snippet name is used to construct the destination file path without sufficient validation, allowing path traversal sequences (for example, ../) to escape the snippets folder and write to any location writable by the user, which could lead to code execution or configuration tampering. ### Patches The fix is available starting with VS Code 1.123.1. The fix (9b31ff896671125cbfc65f33731c4a99660d6201) mitigates this by skipping creating the files outside snippets directory ### Workarounds Do not create profiles from untrusted sources ### References - The patch for this can be found at 9b31ff896671125cbfc65f33731c4a99660d6201 - An issue for this can be found at https://github.com/microsoft/vscode/issues/320679 - MSRC details for this can be found at https://msrc.microsoft.com/update-guide/...